44ee695b532eb984e46de29569ce35854b37d409efaabb6bcf9f5316e2b0546d

Resubmissions

18-04-2024 18:50

240418-xha8wabh29 10

01-01-2024 15:12

240101-slnwxsfeh4 10

Analysis

max time kernel
1562s
max time network
1573s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
Size

2.1MB
MD5

e4bf35b81bfaa0e789ad9461dbacb542
SHA1

dcf7b855b2c3516a6b88a410ef5b44a2c650f62d
SHA256

04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9
SHA512

6635342515a01acde48792cb362dc9e5bd7ffc4fe6a9b8b2fdb0d6c8758d79db847daf28e2fe700a898425214d95d2707337c900c695a47cfd9dada946adf64d
SSDEEP

49152:Iw80cTsjkWanAlfiebWlHcA+G6HYaqK3hUQrObmyPYjR+:Z8sjkrgWezG6lh73jR+

Score

10^/10

collection persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\README-ISHTAR.txt

Ransom Note

# ---------------------------------------------------------------------------------------------------------------------------- # ДЛЯ PACШИФPOBКИ ФAЙЛOB OБPATИTECb HA ПOЧTy [email protected] # ЛИБO HA # BM-NB29yqgNJsWrWJT5fQR1JC5uoz2EoAGV ИCПOЛbЗyЯ BITMESSAGE DESKTOP ИЛИ https://bitmsg.me/ # ---------------------------------------------------------------------------------------------------------------------------- # # БAЗOBЫE TEXHИЧECКИE ДETAЛИ: # > CTaHдapTHый пopядoк шифpoBaHия: AES 256 + RSA 2048. # > Для кaждoгo фaйлa coздaeTcя yHикaлbHый AES ключ. # > PacшифpoBкa HeBoзMoжHa бeз фaйлa ISHTAR.DATA (cM. диpeкTopию %APPDATA%). # # ---------------------------------------------------------------------------------------------------------------------------- # ---------------------------------------------------------------------------------------------------------------------------- # TO DECRYPT YOUR FILES PLEASE WRITE TO [email protected] # OR TO # BM-NB29yqgNJsWrWJT5fQR1JC5uoz2EoAGV USING BITMESSAGE DESKTOP OR https://bitmsg.me/ # ---------------------------------------------------------------------------------------------------------------------------- # # BASIC TECHNICAL DETAILS: # > Standart encryption routine: AES 256 + RSA 2048. # > Every AES key is unique per file. # > Decryption is impossible without ISHTAR.DATA file (see %APPDATA% path). # # ----------------------------------------------------------------------------------------------------------------------------

Emails

[email protected]

URLs

https://bitmsg.me/

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2128 cmd.exe
Executes dropped EXE 6 IoCs

Processes:

pHE3Pm.exepHE3Pm.exepHE3Pm.exepHE3Pm.exepHE3Pm.exepHE3Pm.exe

pid process

2900 pHE3Pm.exe
2636 pHE3Pm.exe
984 pHE3Pm.exe
2044 pHE3Pm.exe
2212 pHE3Pm.exe
1616 pHE3Pm.exe
Loads dropped DLL 1 IoCs

Processes:

04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe

pid process

2972 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2128	cmd.exe

pid	process
2900	pHE3Pm.exe
2636	pHE3Pm.exe
984	pHE3Pm.exe
2044	pHE3Pm.exe
2212	pHE3Pm.exe
1616	pHE3Pm.exe

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

Processes:

pHE3Pm.exepHE3Pm.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	pHE3Pm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	pHE3Pm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\pHE3Pm.exe"	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

pHE3Pm.exe

description	ioc	process
File opened (read-only)	\??\k:	pHE3Pm.exe
File opened (read-only)	\??\p:	pHE3Pm.exe
File opened (read-only)	\??\x:	pHE3Pm.exe
File opened (read-only)	\??\v:	pHE3Pm.exe
File opened (read-only)	\??\y:	pHE3Pm.exe
File opened (read-only)	\??\l:	pHE3Pm.exe
File opened (read-only)	\??\m:	pHE3Pm.exe
File opened (read-only)	\??\r:	pHE3Pm.exe
File opened (read-only)	\??\s:	pHE3Pm.exe
File opened (read-only)	\??\t:	pHE3Pm.exe
File opened (read-only)	\??\w:	pHE3Pm.exe
File opened (read-only)	\??\z:	pHE3Pm.exe
File opened (read-only)	\??\b:	pHE3Pm.exe
File opened (read-only)	\??\g:	pHE3Pm.exe
File opened (read-only)	\??\h:	pHE3Pm.exe
File opened (read-only)	\??\j:	pHE3Pm.exe
File opened (read-only)	\??\q:	pHE3Pm.exe
File opened (read-only)	\??\u:	pHE3Pm.exe
File opened (read-only)	\??\a:	pHE3Pm.exe
File opened (read-only)	\??\e:	pHE3Pm.exe
File opened (read-only)	\??\i:	pHE3Pm.exe
File opened (read-only)	\??\n:	pHE3Pm.exe
File opened (read-only)	\??\o:	pHE3Pm.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\pHE3Pm.exe	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

pHE3Pm.exe

description	pid	process	target process
PID 2636 set thread context of 984	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 set thread context of 2044	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 set thread context of 2212	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 set thread context of 1616	2636	pHE3Pm.exe	pHE3Pm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1088 vssadmin.exe

pid	process
1088	vssadmin.exe

Modifies registry class 5 IoCs

Processes:

pHE3Pm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\System32\\cmd.exe /c vssadmin delete shadows /all /quiet"	pHE3Pm.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command	pHE3Pm.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile	pHE3Pm.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell	pHE3Pm.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open	pHE3Pm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2604 PING.EXE

pid	process
2604	PING.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

pHE3Pm.exepHE3Pm.exepHE3Pm.exe

pid	process
2636	pHE3Pm.exe
2212	pHE3Pm.exe
2212	pHE3Pm.exe
2212	pHE3Pm.exe
2212	pHE3Pm.exe
2212	pHE3Pm.exe
2636	pHE3Pm.exe
984	pHE3Pm.exe
984	pHE3Pm.exe
984	pHE3Pm.exe
984	pHE3Pm.exe
984	pHE3Pm.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

whoami.exevssvc.exewhoami.exe

description	pid	process
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeDebugPrivilege	2796	whoami.exe
Token: SeBackupPrivilege	1936	vssvc.exe
Token: SeRestorePrivilege	1936	vssvc.exe
Token: SeAuditPrivilege	1936	vssvc.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe
Token: SeDebugPrivilege	2548	whoami.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exepHE3Pm.exepHE3Pm.exe

pid	process
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2900	pHE3Pm.exe
2900	pHE3Pm.exe
2900	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exepHE3Pm.exepHE3Pm.exe

pid	process
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
2900	pHE3Pm.exe
2900	pHE3Pm.exe
2900	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe
2636	pHE3Pm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exepHE3Pm.execmd.exepHE3Pm.execmd.exeeventvwr.execmd.exe

description	pid	process	target process
PID 2972 wrote to memory of 1732	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	cmd.exe
PID 2972 wrote to memory of 1732	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	cmd.exe
PID 2972 wrote to memory of 1732	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	cmd.exe
PID 2972 wrote to memory of 1732	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	cmd.exe
PID 2972 wrote to memory of 2900	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	pHE3Pm.exe
PID 2972 wrote to memory of 2900	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	pHE3Pm.exe
PID 2972 wrote to memory of 2900	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	pHE3Pm.exe
PID 2972 wrote to memory of 2900	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	pHE3Pm.exe
PID 2972 wrote to memory of 2128	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	cmd.exe
PID 2972 wrote to memory of 2128	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	cmd.exe
PID 2972 wrote to memory of 2128	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	cmd.exe
PID 2972 wrote to memory of 2128	2972	04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe	cmd.exe
PID 2900 wrote to memory of 2636	2900	pHE3Pm.exe	pHE3Pm.exe
PID 2900 wrote to memory of 2636	2900	pHE3Pm.exe	pHE3Pm.exe
PID 2900 wrote to memory of 2636	2900	pHE3Pm.exe	pHE3Pm.exe
PID 2900 wrote to memory of 2636	2900	pHE3Pm.exe	pHE3Pm.exe
PID 2128 wrote to memory of 2604	2128	cmd.exe	PING.EXE
PID 2128 wrote to memory of 2604	2128	cmd.exe	PING.EXE
PID 2128 wrote to memory of 2604	2128	cmd.exe	PING.EXE
PID 2128 wrote to memory of 2604	2128	cmd.exe	PING.EXE
PID 2636 wrote to memory of 2776	2636	pHE3Pm.exe	cmd.exe
PID 2636 wrote to memory of 2776	2636	pHE3Pm.exe	cmd.exe
PID 2636 wrote to memory of 2776	2636	pHE3Pm.exe	cmd.exe
PID 2636 wrote to memory of 2776	2636	pHE3Pm.exe	cmd.exe
PID 2776 wrote to memory of 2796	2776	cmd.exe	whoami.exe
PID 2776 wrote to memory of 2796	2776	cmd.exe	whoami.exe
PID 2776 wrote to memory of 2796	2776	cmd.exe	whoami.exe
PID 2776 wrote to memory of 2796	2776	cmd.exe	whoami.exe
PID 2636 wrote to memory of 2888	2636	pHE3Pm.exe	eventvwr.exe
PID 2636 wrote to memory of 2888	2636	pHE3Pm.exe	eventvwr.exe
PID 2636 wrote to memory of 2888	2636	pHE3Pm.exe	eventvwr.exe
PID 2636 wrote to memory of 2888	2636	pHE3Pm.exe	eventvwr.exe
PID 2888 wrote to memory of 876	2888	eventvwr.exe	cmd.exe
PID 2888 wrote to memory of 876	2888	eventvwr.exe	cmd.exe
PID 2888 wrote to memory of 876	2888	eventvwr.exe	cmd.exe
PID 876 wrote to memory of 1088	876	cmd.exe	vssadmin.exe
PID 876 wrote to memory of 1088	876	cmd.exe	vssadmin.exe
PID 876 wrote to memory of 1088	876	cmd.exe	vssadmin.exe
PID 2636 wrote to memory of 984	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 984	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 984	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 984	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 984	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 984	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2044	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2044	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2044	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2044	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2044	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2044	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2212	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2212	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2212	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2212	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2212	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2212	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 1616	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 1616	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 1616	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 1616	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 1616	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 1616	2636	pHE3Pm.exe	pHE3Pm.exe
PID 2636 wrote to memory of 2140	2636	pHE3Pm.exe	cmd.exe
PID 2636 wrote to memory of 2140	2636	pHE3Pm.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
"C:\Users\Admin\AppData\Local\Temp\04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.docx"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Roaming\pHE3Pm.exe
  C:\Users\Admin\AppData\Roaming\pHE3Pm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Roaming\pHE3Pm.exe
    "C:\Users\Admin\AppData\Roaming\pHE3Pm.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Roaming\pHE3Pm.tmp"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c whoami /all
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\SysWOW64\whoami.exe
        
        whoami /all
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
  - - C:\Windows\System32\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:876
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:1088
  - - C:\Users\Admin\AppData\Roaming\pHE3Pm.exe
      /scomma C:\Users\Admin\AppData\Roaming\~p9916D88BD6DE.tmp
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:984
  - - C:\Users\Admin\AppData\Roaming\pHE3Pm.exe
      /scomma C:\Users\Admin\AppData\Roaming\~m9916D88BD6DE.tmp
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook accounts
      PID:2044
  - - C:\Users\Admin\AppData\Roaming\pHE3Pm.exe
      /scomma C:\Users\Admin\AppData\Roaming\~p9916D88BD6DE.tmp
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2212
  - - C:\Users\Admin\AppData\Roaming\pHE3Pm.exe
      /scomma C:\Users\Admin\AppData\Roaming\~m9916D88BD6DE.tmp
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook accounts
      PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c whoami /all
      4⤵
      PID:2140
    - - C:\Windows\SysWOW64\whoami.exe
        
        whoami /all
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 localhost > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 localhost
    3⤵
    - Runs ping.exe
    PID:2604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ISHTAR.DATA

Filesize
1KB

MD5
cbf468d5e3d2d6fe3023d6dc32c9e5fb

SHA1
b965fe1580e236f34ced39cf7c36edfe96990c81

SHA256
d721c952dcb8cd2f2fdf81a4d59d88d94345fc0986dfc6fd03d9d6b4a523e34d

SHA512
b4eba261ea6a6e13d8d0a52f3448c6c8096b994ea80768cdb9da78d570032d0630eb39ddd58265f8d7d2bd40c0bb4ea8ce04362fd0fc60977607f2ca3174236e

Download Submit
C:\Users\Admin\AppData\Roaming\ISHTAR.DATA

Filesize
1KB

MD5
7c7f0401533ac0f3bda9395cdc31a297

SHA1
caee409e0a1faa857de3e18fefa19c144ccb0f5c

SHA256
79edc980fd54cc6a232caed93852d18b98e8ae41e0858dfb32cc39c42ce3c6c6

SHA512
7c47a66af2176f0ffde73b0a643d01cf6c4b41f5acf98117e8963cad02d89cfbea6b95d88fa05f8469671bf20a1736fff3b76fa44fc2a210d928e92266444abf

Download Submit
C:\Users\Admin\AppData\Roaming\README-ISHTAR.txt

Filesize
1KB

MD5
d0b60b9da3f226f60e9ff83521494239

SHA1
fd5080ed66bb3e17849d553ce97c25571f4d16d3

SHA256
25a6ca4bcaec2618aa5e0d997a2ec767abdf337ddb81a6a2cd3553724902f695

SHA512
d6c61cea2ad38a8f425fab766cdff9e58a9f642dda6f340836cfaa509f859b7b4ffd75e5d583a8c8154d05f0c7bfb7b0c0dc4181eaefcc1d2c6879037cf2838c

Download Submit
C:\Users\Admin\AppData\Roaming\pHE3Pm.tmp

Filesize
1.2MB

MD5
369ab221049cd9560602b9e5aebf2dda

SHA1
029ec59baaee07a6317b42c446f02d7192766812

SHA256
d8c61b75dcffc31bb0016d4164f7e21d767b70f53e775da8fb964928782e13da

SHA512
14aa5aef2c682e3220c59f9ee143befe5b5d9f50d4a71028d4161098ff33a6f75348622ab837c556843feaad2300ec51d5affa92dea364fd8d751c426bd717c3

Download Submit
C:\Users\Admin\AppData\Roaming\~p9916D88BD6DE.tmp

Filesize
112B

MD5
36427ecb2a0faf13af3047c51b29f9c5

SHA1
9a3fb26927a7aa81255cf8abcc1f1c3e38f28c4f

SHA256
ea156f649bb1180b32c6d5be76c0969941ec76d1fface734f401b5327ac57345

SHA512
4e1ff95c087545b9fe56bbc008516d1e0bbecd9cae246d7baecd7773404e24678ec22b515ec6e6f715081fd079e6d400aa4060abaf9346cdc609873be76833f0

Download Submit
C:\Users\Admin\Desktop\04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.docx

Filesize
276B

MD5
b357929e7562d4866aa5958c9575895c

SHA1
ee700b2b7664cb45619472df2f41e6b114ca1aef

SHA256
9c0249341882665020d594e260fcd4fbdeb2cecae4f76609bbc58167908c392f

SHA512
88481327fee6c707ec0e145021f3c7710a053fa8c1da47e7897f7c9f9526c5f70fc1d5e1dc1a2beaf22b212063cf37a02ddcc1d16743d032b899b0aadc6945f0

Download Submit
\Users\Admin\AppData\Roaming\pHE3Pm.exe

Filesize
2.1MB

MD5
e4bf35b81bfaa0e789ad9461dbacb542

SHA1
dcf7b855b2c3516a6b88a410ef5b44a2c650f62d

SHA256
04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9

SHA512
6635342515a01acde48792cb362dc9e5bd7ffc4fe6a9b8b2fdb0d6c8758d79db847daf28e2fe700a898425214d95d2707337c900c695a47cfd9dada946adf64d

Download Submit
memory/984-155-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1616-179-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2636-26-0x00000000007A0000-0x00000000007AB000-memory.dmp

Filesize
44KB

Download